If you want to search for UDRs with specific values on certain fields, you can configure these fields in the Searchable Fields dialog.
Searchable Fields dialog
Note!
These configurations have to be made before UDRs are sent to the ECS by the ECS forwarding agent.
To configure searchable fields:
In the Labels tab, click on the Add button.
The Add Label dialog opens.
Add Label dialog
Enter a name for the label in the Label field and click on the Add button.
The new label is added in the Defined Field Labels list.
Repeat the previous step for all the labels you want to add, and then click on the Close button to close the dialog.
Note!
The maximum number of labels you can add is ten.
Click on the Mappings tab to map UDR fields to the different labels.
Click on the Add button to open the UDR Browser.
Select the UDR type you want to add and click OK.
The UDR type is added in the UDR Types field and the UDR Browser is closed.
Repeat the previous step for all the UDR types you want to add.
Select a UDR type in the UDR Types field, and double click on the UDR Field column for a label you want to associate a UDR field with.
The Select UDR Field dialog opens.
Select the field in the UDR and click OK.
The selected field is listed in the UDR Field column for the label and the dialog is closed.
Repeat the previous step for all the UDR Types you want map fields from.
Note!
This enables you to map one field from each UDR type to a certain label.
Click on the Save button when you are finished with your configuration.
The configuration is saved, and the next time the ECS receives UDRs from an ECS forwarding agent, the configured UDR fields are added as meta data and can later be used for making searches, see 9.24.4.4 Searching the ECS.